1100 lines
No EOL
33 KiB
JSON
1100 lines
No EOL
33 KiB
JSON
{
|
|
"Event": {
|
|
"analysis": "1",
|
|
"date": "2017-05-17",
|
|
"extends_uuid": "",
|
|
"info": "2017-05-15 Malspam 00_Invoice_###.PDF",
|
|
"publish_timestamp": "1495014761",
|
|
"published": true,
|
|
"threat_level_id": "3",
|
|
"timestamp": "1495010518",
|
|
"uuid": "591bfbca-a168-4ca0-b1d8-4c14950d210f",
|
|
"Orgc": {
|
|
"name": "CIRCL",
|
|
"uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
|
|
},
|
|
"Tag": [
|
|
{
|
|
"colour": "#ffffff",
|
|
"local": "0",
|
|
"name": "tlp:white",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#0088cc",
|
|
"local": "0",
|
|
"name": "misp-galaxy:ransomware=\"Jaff\"",
|
|
"relationship_type": ""
|
|
}
|
|
],
|
|
"Attribute": [
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1495010518",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "591bfbcc-a984-46ea-86ac-4f84950d210f",
|
|
"value": "133fe54c189f9fd793babf879179b068"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1495010518",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "591bfbd2-bd58-4095-8336-4d11950d210f",
|
|
"value": "f5ebb00e1fb9bbcfe5ae742082e2002f"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1495010518",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "591bfbd8-03c4-4aa1-a483-4e96950d210f",
|
|
"value": "eb680f46c268e6eac359b574538de569"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1495010518",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "591bfbda-f3dc-442a-945f-4b5e950d210f",
|
|
"value": "5968b7a89e5d1db8447b5343f20362ab713551a94226fb905fff7a067c770c79"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1495010518",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "591bfbdc-e530-43bf-a794-4f68950d210f",
|
|
"value": "46ee7490b657edfbcbd6ebc2070548e2eb72bda3a054cf60fd7627345bd0575b"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1495010518",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "591bfbde-3914-450d-ae96-4dcc950d210f",
|
|
"value": "http://5hdnnd74fffrottd.com/af/hHGFjd"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1495010518",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "591bfbdf-8790-4ddf-bc34-4257950d210f",
|
|
"value": "5hdnnd74fffrottd.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "5hdnnd74fffrottd.com",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1495010518",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "591bfbe2-b958-4cf0-b397-4dda950d210f",
|
|
"value": "34.209.214.237"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1495010518",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "591bfbe3-a02c-439a-ad26-4372950d210f",
|
|
"value": "http://bianshop.com/hHGFjd"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1495010518",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "591bfbe4-b31c-40f1-9935-4641950d210f",
|
|
"value": "bianshop.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "bianshop.com",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1495010518",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "591bfbe6-2f64-45e4-b8a7-4ae3950d210f",
|
|
"value": "112.78.6.183"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1495010518",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "591bfbe7-4370-4b8f-83f6-499e950d210f",
|
|
"value": "http://bizcleaning.co.uk/hHGFjd"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1495010518",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "591bfbe8-450c-4ca2-a711-4474950d210f",
|
|
"value": "bizcleaning.co.uk"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "bizcleaning.co.uk",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1495010518",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "591bfbea-f978-48f0-a750-4eeb950d210f",
|
|
"value": "160.153.162.140"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1495010518",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "591bfbeb-e6bc-49a8-9d28-4803950d210f",
|
|
"value": "http://boolas.com/hHGFjd"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1495010518",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "591bfbec-0950-4b49-a66c-44de950d210f",
|
|
"value": "boolas.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "boolas.com",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1495010518",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "591bfbee-579c-42f8-95ef-46f4950d210f",
|
|
"value": "185.24.219.110"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1495010518",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "591bfbef-6148-4d0c-ab4f-4106950d210f",
|
|
"value": "http://byydei74fg43ff4f.net/af/hHGFjd"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1495010518",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "591bfbf0-7268-4064-83a3-4099950d210f",
|
|
"value": "byydei74fg43ff4f.net"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1495010518",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "591bfbf4-3f44-47a2-83e3-4523950d210f",
|
|
"value": "http://dcfarbicka.sk/hHGFjd"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1495010518",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "591bfbf6-fd4c-4961-9ada-4a13950d210f",
|
|
"value": "dcfarbicka.sk"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "dcfarbicka.sk",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1495010518",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "591bfbf8-ec8c-4f14-8618-4836950d210f",
|
|
"value": "5.10.105.54"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1495010518",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "591bfbf9-ba14-4815-9abb-4309950d210f",
|
|
"value": "http://diasgroup.sk/hHGFjd"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1495010518",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "591bfbfb-88e0-4248-afa2-4f3a950d210f",
|
|
"value": "diasgroup.sk"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "diasgroup.sk",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1495010518",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "591bfbfd-c4fc-449a-8dfc-4779950d210f",
|
|
"value": "85.248.29.38"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1495010518",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "591bfbfe-b614-4ea7-8d8c-4fb7950d210f",
|
|
"value": "http://djkammerthal.de/hHGFjd"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1495010518",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "591bfc00-2fb0-4cdd-83a0-45b6950d210f",
|
|
"value": "djkammerthal.de"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "djkammerthal.de",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1495010518",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "591bfc02-dc44-47c6-a586-4d98950d210f",
|
|
"value": "81.169.145.161"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1495010518",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "591bfc03-8bf4-40d3-bde0-4101950d210f",
|
|
"value": "http://dovahosting.com/hHGFjd"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1495010518",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "591bfc05-0628-48b3-925c-48b7950d210f",
|
|
"value": "dovahosting.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "dovahosting.com",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1495010518",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "591bfc06-b21c-41e4-9ddc-4f8f950d210f",
|
|
"value": "193.70.44.106"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1495010518",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "591bfc08-2f14-40c1-9767-4a8b950d210f",
|
|
"value": "http://dsintergrated.com/hHGFjd"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1495010518",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "591bfc09-c4dc-4a59-b112-41a5950d210f",
|
|
"value": "dsintergrated.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "dsintergrated.com",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1495010518",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "591bfc0c-6368-4a38-94ae-4e48950d210f",
|
|
"value": "116.0.121.220"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1495010518",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "591bfc0e-f68c-4639-a69c-45e5950d210f",
|
|
"value": "http://ecbuyjp.com/hHGFjd"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1495010518",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "591bfc0f-3174-4917-a11b-4662950d210f",
|
|
"value": "ecbuyjp.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "ecbuyjp.com",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1495010518",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "591bfc11-00a4-439a-adff-4690950d210f",
|
|
"value": "47.91.145.254"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1495010518",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "591bfc14-fbb4-4e10-ac3f-4e9f950d210f",
|
|
"value": "http://ecuamiaflowers.com/hHGFjd"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1495010518",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "591bfc15-2f80-4f92-80db-4f0d950d210f",
|
|
"value": "ecuamiaflowers.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "ecuamiaflowers.com",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1495010518",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "591bfc17-14ac-4e03-9bb3-41ca950d210f",
|
|
"value": "107.180.14.32"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1495010518",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "591bfc19-0414-42b4-899e-43b1950d210f",
|
|
"value": "http://energybalancecenter.nl/hHGFjd"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1495010518",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "591bfc1b-a748-48cb-8db5-4295950d210f",
|
|
"value": "energybalancecenter.nl"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "energybalancecenter.nl",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1495010518",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "591bfc1e-f5f8-446f-baf4-4684950d210f",
|
|
"value": "78.46.162.14"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1495010518",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "591bfc20-f7e0-47a4-b1a5-4982950d210f",
|
|
"value": "http://fotografikum.com/hHGFjd"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1495010518",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "591bfc22-0090-4c3e-8442-43f5950d210f",
|
|
"value": "fotografikum.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "fotografikum.com",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1495010518",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "591bfc23-be98-4f21-8f80-4bc4950d210f",
|
|
"value": "185.2.31.189"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1495010518",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "591bfc25-d26c-4237-9831-4a0c950d210f",
|
|
"value": "http://hncdc.org/hHGFjd"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1495010518",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "591bfc27-d848-4100-882b-4c62950d210f",
|
|
"value": "hncdc.org"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "hncdc.org",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1495010518",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "591bfc2a-b130-4ab8-9334-4691950d210f",
|
|
"value": "61.191.55.24"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1495010518",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "591bfc2b-0628-4a9a-afe4-454e950d210f",
|
|
"value": "http://hrlpk.com/hHGFjd"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1495010518",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "591bfc2d-0e90-40a9-a559-4bfc950d210f",
|
|
"value": "hrlpk.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "hrlpk.com",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1495010518",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "591bfc2f-1b5c-4d2d-8172-44d9950d210f",
|
|
"value": "203.124.43.229"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1495010518",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "591bfc32-5410-4413-a5ec-40b4950d210f",
|
|
"value": "http://oyasinsaat.com.tr/hHGFjd"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1495010518",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "591bfc33-582c-4087-b030-468c950d210f",
|
|
"value": "oyasinsaat.com.tr"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "oyasinsaat.com.tr",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1495010518",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "591bfc36-e094-455c-ad6c-4111950d210f",
|
|
"value": "94.73.148.80"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1495010518",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "591bfc38-bda4-49d8-9539-435e950d210f",
|
|
"value": "http://phoicanh3d.com/hHGFjd"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1495010518",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "591bfc39-8e88-45c4-b1d7-45e7950d210f",
|
|
"value": "phoicanh3d.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "phoicanh3d.com",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1495010518",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "591bfc3c-2818-4165-a56f-4221950d210f",
|
|
"value": "69.64.147.39"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1495010518",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "591bfc3e-ec5c-46e7-bfc4-4f5c950d210f",
|
|
"value": "http://ppapmoozamiz.com/hHGFjd"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1495010518",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "591bfc40-2c5c-42d2-a9bc-4441950d210f",
|
|
"value": "ppapmoozamiz.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "ppapmoozamiz.com",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1495010518",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "591bfc42-cbc0-4298-ac6d-4e2b950d210f",
|
|
"value": "166.62.27.56"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1495010518",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "591bfc44-b68c-405f-a3e2-4dd8950d210f",
|
|
"value": "http://rooana.com/hHGFjd"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1495010518",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "591bfc46-e8a4-4af9-9663-418e950d210f",
|
|
"value": "rooana.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "rooana.com",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1495010518",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "591bfc48-53bc-4736-ad7d-4203950d210f",
|
|
"value": "81.177.135.222"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1495010518",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "591bfc4a-e1a4-4b6c-b88f-4613950d210f",
|
|
"value": "http://sjffonrvcik45bd.info/af/hHGFjd"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1495010518",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "591bfc4c-7880-4a0c-bd40-448e950d210f",
|
|
"value": "sjffonrvcik45bd.info"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1495010518",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "591bfc50-9d18-4641-9a25-4493950d210f",
|
|
"value": "http://tutmacli.com/hHGFjd"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1495010518",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "591bfc53-08b0-42a2-8fcd-4aa7950d210f",
|
|
"value": "tutmacli.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "tutmacli.com",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1495010518",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "591bfc55-5064-4b3a-b114-4ad0950d210f",
|
|
"value": "93.89.224.41"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1495010518",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "591bfc57-04a8-491a-86ae-4256950d210f",
|
|
"value": "http://urachart.com/hHGFjd"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1495010518",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "591bfc5a-d1cc-4427-8813-4b27950d210f",
|
|
"value": "urachart.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "urachart.com",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1495010518",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "591bfc5d-9748-48e6-b4ff-46e4950d210f",
|
|
"value": "203.170.192.184"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1495010518",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "591bfc5f-c590-458e-9243-4667950d210f",
|
|
"value": "http://vasroc.pt/hHGFjd"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1495010518",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "591bfc61-fd94-4a8d-ae51-4d2f950d210f",
|
|
"value": "vasroc.pt"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "vasroc.pt",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1495010518",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "591bfc64-e7ec-4857-a131-4c12950d210f",
|
|
"value": "89.26.241.3"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1495010518",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "591bfc66-d01c-4b9b-8b83-436e950d210f",
|
|
"value": "http://vbplan.de/hHGFjd"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1495010518",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "591bfc68-13d0-4336-93ce-4b5b950d210f",
|
|
"value": "vbplan.de"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "vbplan.de",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1495010518",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "591bfc6a-be54-4d9e-a0c3-4873950d210f",
|
|
"value": "81.169.145.156"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1495010518",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "591bfc6d-d174-4fe2-9e1c-4245950d210f",
|
|
"value": "http://h552terriddows.com/a5/"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1495010518",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "591bfc6f-0b8c-46eb-a0f0-4689950d210f",
|
|
"value": "h552terriddows.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1495010518",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "591bfca0-dbf8-431f-8b6d-43b6950d210f",
|
|
"value": "urachart.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1495010518",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "591bfca6-92e4-4098-983b-4d9f950d210f",
|
|
"value": "fotografikum.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1495010518",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "591bfcae-b39c-4330-9d16-4705950d210f",
|
|
"value": "5hdnnd74fffrottd.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1495010518",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "591bfcb5-adf8-46b9-9da1-46ea950d210f",
|
|
"value": "byydei74fg43ff4f.net"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1495010518",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "591bfcbb-ef40-4919-bb0a-4a49950d210f",
|
|
"value": "sjffonrvcik45bd.info"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1495010518",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "591bfcc2-32c0-46fc-9c4f-471e950d210f",
|
|
"value": "https://www.virustotal.com/en/file/5968b7a89e5d1db8447b5343f20362ab713551a94226fb905fff7a067c770c79/analysis/"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1495010518",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "591bfcc4-1248-4932-8aba-4351950d210f",
|
|
"value": "https://www.virustotal.com/en/file/46ee7490b657edfbcbd6ebc2070548e2eb72bda3a054cf60fd7627345bd0575b/analysis/1494844171/"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1495010518",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "591bfcc7-1e10-492b-a57d-43ed950d210f",
|
|
"value": "https://www.hybrid-analysis.com/sample/5968b7a89e5d1db8447b5343f20362ab713551a94226fb905fff7a067c770c79?environmentId=100"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1495010518",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "591bfcc9-de70-45ac-9998-4997950d210f",
|
|
"value": "http://urachart"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1495010518",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "591bfcce-a7c4-4f4b-8071-491f950d210f",
|
|
"value": "h552terriddows.com/a5/"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "- Xchecked via VT: 46ee7490b657edfbcbd6ebc2070548e2eb72bda3a054cf60fd7627345bd0575b",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1495010562",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "591c0d02-622c-403e-a092-4e5d02de0b81",
|
|
"value": "1a27d6090a49faffc06a5df91b5fe626ab9c3bfe"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "- Xchecked via VT: 46ee7490b657edfbcbd6ebc2070548e2eb72bda3a054cf60fd7627345bd0575b",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1495010562",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "591c0d02-2ac0-4ef2-9491-49af02de0b81",
|
|
"value": "https://www.virustotal.com/file/46ee7490b657edfbcbd6ebc2070548e2eb72bda3a054cf60fd7627345bd0575b/analysis/1495009140/"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "- Xchecked via VT: 5968b7a89e5d1db8447b5343f20362ab713551a94226fb905fff7a067c770c79",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1495010562",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "591c0d02-8dec-4783-8010-485302de0b81",
|
|
"value": "3f0854a535979bbf7f992850e3cc0d9e6f1401ca"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "- Xchecked via VT: 5968b7a89e5d1db8447b5343f20362ab713551a94226fb905fff7a067c770c79",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1495010563",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "591c0d03-3760-4207-85b3-477602de0b81",
|
|
"value": "https://www.virustotal.com/file/5968b7a89e5d1db8447b5343f20362ab713551a94226fb905fff7a067c770c79/analysis/1494954523/"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "- Xchecked via VT: f5ebb00e1fb9bbcfe5ae742082e2002f",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1495010563",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "591c0d03-7a34-4e05-b3e1-44a402de0b81",
|
|
"value": "41bce3e382cee06aa65fbee15fd38f7187fb090d5da78d868f57c84197689287"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "- Xchecked via VT: f5ebb00e1fb9bbcfe5ae742082e2002f",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1495010564",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "591c0d04-f690-4ae7-baf0-457c02de0b81",
|
|
"value": "83edee74728aa231cb77d62a442fa560c64ecdee"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "- Xchecked via VT: f5ebb00e1fb9bbcfe5ae742082e2002f",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1495010564",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "591c0d04-a760-4f1e-89e8-462202de0b81",
|
|
"value": "https://www.virustotal.com/file/41bce3e382cee06aa65fbee15fd38f7187fb090d5da78d868f57c84197689287/analysis/1494990394/"
|
|
}
|
|
]
|
|
}
|
|
} |